"Root",
1 => "Client",
2 => "Admin",
3 => "Bundle",
4 => "Client",
5 => "Client Private Key",
6 => "Admin",
7 => "Admin Private Key",
8 => "Root",
9 => "Client");
class certificate
{
var $startD;
var $endDate;
var $certFile;
function certificate($certificateFile)
{
$this->certFile = $certificateFile;
}
function ispemfile()
{
$status=false;
$cmd="/usr/bin/openssl x509 -in ".$this->certFile." -text -noout >>/tmp/results";
exec($cmd,$results,$rc);
if ($rc == 0)
{
$status=true;
}
else
{
error_log("results: ".print_r($results,true));
}
return $status;
}
function getDate($type)
{
$date = '';
// option = -startdate or -enddate
$dateOption = '-' . $type . 'date';
$cmd = " /usr/bin/openssl x509 -noout -in " . $this->certFile . " $dateOption";
$str = exec($cmd, $da, $rc);
if ($rc == 0)
{
// expected format:
// notBefore=Apr 19 13:51:18 2011 GMT
$tokens = explode('=', $str);
if (count($tokens) > 1)
{
$date = $tokens[1];
}
}
return $date;
}
function isValid($key)
{
$error=0;
// check whether pem file is valid
$cmd="/home/embedded/library/AppManager/bin/sslcertvalidate.sh ".$this->certFile;
exec($cmd,$results,$rc);
error_log("results: ".print_r($results,true));
if ($results[0] == "Valid")
{
error_log("Certificate file date ranges are valid.");
// verify the certificate matches the primary key
$kMod=exec("/usr/bin/openssl rsa -noout -in ".$key." -modulus | /usr/bin/openssl md5");
$cMod=exec("/usr/bin/openssl x509 -noout -in ".$this->certFile." -modulus | /usr/bin/openssl md5");
if ($cMod == $kMod)
{
error_log("Certificate matches Primary key.");
}
else
{
error_log("Certificate does not match Primary key.");
$error=CERT_KEY_MISMATCH;
}
}
else
{
error_log("Certificate file dates are ".$results[0]);
$error=CERTIFICATE_VALIDATION_FAILED;
}
return $error;
}
function containsPrimaryKey()
{
$status=false;
//verify that the primary key is in the file
$cmd="/usr/bin/openssl rsa -noout -in ".$this->certFile." -modulus";
exec($cmd,$results,$rc);
if ($rc == 0)
{
$kMod=exec("/usr/bin/openssl rsa -noout -in ".$this->certFile." -modulus | /usr/bin/openssl md5");
$cMod=exec("/usr/bin/openssl x509 -noout -in ".$this->certFile." -modulus | /usr/bin/openssl md5");
if ($cMod == $kMod)
{
error_log("Certificate matches Primary key.");
$status=true;
}
else
{
error_log("The certificate and primary key in the file do not match.");
}
}
else
{
error_log("Certificate file does not contain primary key.");
}
return $status;
}
}
class sslCertInfo
{
var $issuer;
var $subject;
var $notBefore;
var $notAfter;
var $status;
var $type;
function sslCertInfo($issuer,
$subject,
$notBefore,
$notAfter,
$status,
$type)
{
$this->issuer = $issuer;
$this->subject = $subject;
$this->notBefore = $notBefore;
$this->notAfter = $notAfter;
$this->status = $status;
$this->type = $type;
}
}
function updateSystemSSLCertificate($cert,$key)
{
if ( $key == "")
{
error_log("Uploading signed certificate and private key pair.");
$cmd="/usr/bin/cp ".$cert." /tmp/ssl.pem";
exec($cmd,$results,$rc);
}
else
{
error_log("Appending signed certificate to private key.");
$cmd="/usr/bin/cp ".$key." /tmp/ssl.pem";
exec($cmd,$results,$rc);
$cmd="/bin/cat ".$cert." >>/tmp/ssl.pem";
exec($cmd,$results,$rc);
//remove the primary key file
$cmd="sudo /bin/mv ".$key." /tmp";
error_log("Move command: ".$cmd);
exec($cmd,$esults,$rc);
}
error_log("Moving new ssl.pem file to /home/embedded/library/HTTPService/certs.");
$cmd="/bin/chmod 440 /tmp/ssl.pem";
exec($cmd,$results,$rc);
// udpate lighttpd ssl file
$cmd="sudo /bin/mv /tmp/ssl.pem /home/embedded/library/HTTPService/certs/ssl.pem";
exec($cmd,$results,$rc);
}
function print_ssl_cert_info($info)
{
error_log("info data: ".print_r($info,true));
if ($info->status == "Valid")
$status = "Valid";
else
$status = "Expired";
// Highlight the tags in the Issuer and Subject
$old = array("C:", "ST:", "L:", "O:", "OU:", "CN:");
$new = array("C:", "ST:", "L:", "O:", "OU:", "CN:");
$Issuer = str_replace($old, $new, $info->issuer);
$Subject = str_replace($old, $new, $info->subject);
?>
type?>
notBefore?> notAfter?>
Issuer:
Subject:
context = "sslCertImport";
// move the file
$tmpname=$_FILES['certFile']['tmp_name'];
$cmd="/bin/mv ".$tmpname." ".$signedCertFile;
exec($cmd,$results,$rc);
$signedCertificate=new certificate($signedCertFile);
if ($signedCertificate->ispemfile())
{
error_log("A pem file has been uploaded.");
if (file_exists($primaryKeyFile))
{
//Validate that the signed certificate matches primary key
$rc=$signedCertificate->isValid($primaryKeyFile);
if ($rc == 0)
{
error_log("PEM file is valid.");
//update ssl.pem file with new primary key and certificate
updateSystemSSLCertificate($signedCertFile,$primaryKeyFile);
}
else
{
//check to see if there is a primary key in the certificate file
if ($signedCertificate->containsPrimaryKey())
{
updateSystemSSLCertificate($signedCertFile,"");
}
else
{
error_log("PEM file failed validation.");
$status->setErrorCode($rc); //Certificate Error
}
}
}
else
{
//check to see if there is a primary key in the certificate file
if ($signedCertificate->containsPrimaryKey())
{
updateSystemSSLCertificate($signedCertFile,"");
}
else
{
error_log("PEM file failed validation.");
$status->setErrorCode(CERTIFICATE_VALIDATION_FAILED); //Certificate Error
}
}
}
else
{
error_log("Uploaded file is not a pem file.");
$status->setErrorCode(NOT_PEM_CERTIFICATE); //Not a pem file
}
print $status->out();
return;
}
else
{
error_log("Loading ssl certificate import page.");
}
?>
Tools - SSL Communication Certificate Import